CCNA 3 v7.02 & v8 (ENSA) Complete Final Exam & Modules 1

Verified question bank for CCNA 3 v7.02 & v8 (Enterprise Networking, Security, and Automation - ENSA) Modules 1–2, 3–5, 6–8, 9–12, 13–14 & Final Exam.

📥 Download CCNA 3 v7.02 & v8 (ENSA) Complete Final Exam & Modules 1 - 14 Master Question Bank (2026) Packet Tracer (.PKA) & Verified PDF Guide

Includes complete Cisco NetAcad v7.02 / v8 topology file (.pka) and IOS CLI configuration script.

Verified Cisco NetAcad Exam Questions (38 Core Questions + Explanations)

Question 1 In Single-Area OSPFv2, what is the exact order of precedence a Cisco router uses to select its 32-bit Router ID (RID)?

A. 1. Manual 'router-id' command -> 2. Highest active Loopback IPv4 address -> 3. Highest active physical interface IPv4 address
B. 1. Lowest MAC address -> 2. Highest physical IP -> 3. Loopback IP
C. 1. Highest physical IP -> 2. Manual router-id -> 3. Loopback IP
D. 1. OSPF priority 255 -> 2. Lowest IP address

✔ Correct Answer: A. 1. Manual 'router-id' command -> 2. Highest active Loopback IPv4 address -> 3. Highest active physical interface IPv4 address

Technical Explanation: OSPF selects its Router ID using: (1) explicitly configured 'router-id x.x.x.x', (2) highest IPv4 address on any up Loopback interface, or (3) highest IPv4 address on any active physical interface.

Question 2 On a broadcast multiaccess Ethernet segment, how do OSPF routers elect the Designated Router (DR) and Backup Designated Router (BDR), and how can you prevent a router from ever becoming DR/BDR?

A. Highest interface OSPF priority wins (tie-breaker: highest Router ID); setting 'ip ospf priority 0' prevents a router from participating in the DR/BDR election.
B. Lowest Router ID wins; setting priority 255 disables DR election.
C. Fastest interface bandwidth wins.
D. The router with the lowest MAC address becomes DR.

✔ Correct Answer: A. Highest interface OSPF priority wins (tie-breaker: highest Router ID); setting 'ip ospf priority 0' prevents a router from participating in the DR/BDR election.

Technical Explanation: OSPF interface priority defaults to 1 (range 0–255). The highest priority becomes DR (tie-breaker: highest RID). Setting 'ip ospf priority 0' forces the router to remain a DROTHER.

Question 3 What is the default OSPF Reference Bandwidth on Cisco routers, and why must you use 'auto-cost reference-bandwidth' in modern networks?

A. Default is 100 Mbps (10^8 bps), which assigns the same OSPF cost of 1 to FastEthernet (100M), GigabitEthernet (1G), and 10G links unless the reference bandwidth is increased (e.g., auto-cost reference-bandwidth 10000).
B. Default is 100 Gbps, which blocks 1G links.
C. OSPF uses hop count instead of bandwidth.
D. Reference bandwidth only applies to serial links.

✔ Correct Answer: A. Default is 100 Mbps (10^8 bps), which assigns the same OSPF cost of 1 to FastEthernet (100M), GigabitEthernet (1G), and 10G links unless the reference bandwidth is increased (e.g., auto-cost reference-bandwidth 10000).

Technical Explanation: Because OSPF Cost = Reference Bandwidth / Interface Bandwidth (and integer values cannot be less than 1), any link 100 Mbps or faster gets a cost of 1 by default. Increasing the reference bandwidth on all OSPF routers allows OSPF to distinguish between 100M, 1G, and 10G links.

Question 4 Which cuatro parameters in OSPF Hello packets MUST match between two neighboring routers for them to form an OSPF adjacency?

A. Area ID, Hello/Dead Timers, Subnet Mask (on multiaccess links), and Authentication
B. Router ID, Interface Priority, OSPF Process ID, and Hostname
C. OSPF Cost, Reference Bandwidth, Loopback IP, and IOS Version
D. MAC Address, VLAN ID, HSRP Group, and NTP Server

✔ Correct Answer: A. Area ID, Hello/Dead Timers, Subnet Mask (on multiaccess links), and Authentication

Technical Explanation: Process ID is locally significant and Router IDs must be unique (different). However, Area ID, Hello/Dead intervals, Network Type/Subnet Mask, Authentication, and Stub flags must match.

Question 5 What is the wildcard mask that matches only the 192.168.16.0 through 192.168.31.255 summary block (/20)?

A. 0.0.15.255
B. 0.0.0.255
C. 255.255.240.0
D. 0.0.31.255

✔ Correct Answer: A. 0.0.15.255

Technical Explanation: A /20 subnet mask is 255.255.240.0. Subtracting 255.255.240.0 from 255.255.255.255 yields the wildcard mask 0.0.15.255.

Question 6 Where should Standard IPv4 ACLs (1–99) and Extended IPv4 ACLs (100–199) be placed according to Cisco best practices, and why?

A. Standard ACLs closest to the destination (since they filter only by source IP); Extended ACLs closest to the source (since they filter by source, destination, and protocol/port).
B. Standard ACLs closest to the source; Extended ACLs closest to the destination.
C. Both must be placed exclusively on WAN serial interfaces.
D. Both must be applied outbound on Loopback0.

✔ Correct Answer: A. Standard ACLs closest to the destination (since they filter only by source IP); Extended ACLs closest to the source (since they filter by source, destination, and protocol/port).

Technical Explanation: Standard ACLs only examine the Source IP, so placing them near the source would block traffic to all destinations. Extended ACLs match exact source/destination/port pairs and are placed near the source to drop unwanted traffic immediately.

Question 7 An administrator creates an ACL to restrict SSH access to a router's VTY lines using the standard named ACL 'ADMIN-MGT'. Which command applies this ACL to the VTY lines?

A. ip access-group ADMIN-MGT in
B. access-class ADMIN-MGT in
C. transport input ADMIN-MGT
D. login access-list ADMIN-MGT

✔ Correct Answer: B. access-class ADMIN-MGT in

Technical Explanation: On physical/SVI interfaces, ACLs are applied using 'ip access-group [acl] in|out'. On VTY lines ('line vty 0 4'), ACLs are applied using 'access-class [acl] in'.

Question 8 In NAT terminology, a host at 192.168.1.10 sends a packet through a NAT router (public IP 203.0.113.5) to an external web server at 198.51.100.20. What are the Inside Local, Inside Global, and Outside Global addresses?

A. Inside Local: 192.168.1.10; Inside Global: 203.0.113.5; Outside Global: 198.51.100.20
B. Inside Local: 203.0.113.5; Inside Global: 192.168.1.10; Outside Global: 198.51.100.20
C. Inside Local: 198.51.100.20; Inside Global: 203.0.113.5; Outside Global: 192.168.1.10
D. All three are 203.0.113.5

✔ Correct Answer: A. Inside Local: 192.168.1.10; Inside Global: 203.0.113.5; Outside Global: 198.51.100.20

Technical Explanation: Inside Local is the private IP of the internal host (192.168.1.10). Inside Global is the public IP representing the internal host to the outside world (203.0.113.5). Outside Global is the public IP of the external server (198.51.100.20).

Question 9 Which command configures PAT (NAT Overload) so that all hosts matched by ACL 1 share the public IP address assigned to interface GigabitEthernet0/0/1?

A. ip nat inside source list 1 interface GigabitEthernet0/0/1 overload
B. ip nat inside source static 192.168.1.10 203.0.113.5
C. ip nat outside source list 1 pool PUBLIC
D. ip pat overload GigabitEthernet0/0/1

✔ Correct Answer: A. ip nat inside source list 1 interface GigabitEthernet0/0/1 overload

Technical Explanation: The 'overload' keyword enables Port Address Translation (PAT), allowing thousands of internal hosts in ACL 1 to share the single public IP of exit interface Gi0/0/1 via unique TCP/UDP port numbers.

Question 10 What are the four core security functions provided by the IPsec framework (Confidentiality, Integrity, Authentication, and Secure Key Exchange)?

A. Confidentiality: AES/3DES; Integrity: HMAC-SHA1/SHA256; Authentication: PSK or RSA Certificates; Key Exchange: Diffie-Hellman (DH)
B. Confidentiality: MD5; Integrity: DES; Authentication: Telnet; Key Exchange: FTP
C. Confidentiality: SHA-256; Integrity: RSA; Authentication: DH; Key Exchange: AES
D. IPsec does not encrypt traffic, it only routes GRE packets.

✔ Correct Answer: A. Confidentiality: AES/3DES; Integrity: HMAC-SHA1/SHA256; Authentication: PSK or RSA Certificates; Key Exchange: Diffie-Hellman (DH)

Technical Explanation: IPsec uses encryption algorithms (AES) for confidentiality, hashing (SHA) for packet integrity, Pre-Shared Keys (PSK) or RSA certificates for peer authentication, and Diffie-Hellman (DH groups) for establishing shared secret keys over an untrusted network.

Question 11 In Syslog message logging on Cisco IOS devices, there are 8 severity levels (0 to 7). Which severity levels correspond to Level 0, Level 3, Level 4, and Level 7?

A. 0: Emergencies, 3: Errors, 4: Warnings, 7: Debugging
B. 0: Debugging, 3: Notifications, 4: Errors, 7: Emergencies
C. 0: Informational, 3: Critical, 4: Alerts, 7: Warnings
D. All Syslog messages use Level 5 only.

✔ Correct Answer: A. 0: Emergencies, 3: Errors, 4: Warnings, 7: Debugging

Technical Explanation: Mnemonic 'Every Awesome Cisco Engineer Will Need Icecream Daily': 0-Emergencies, 1-Alerts, 2-Critical, 3-Errors, 4-Warnings, 5-Notifications, 6-Informational, 7-Debugging (lower numbers are more severe).

Question 12 In Network Automation and Programmability, what is the difference between Control Plane and Data Plane in an SDN (Software-Defined Networking) architecture?

A. The Control Plane is centralized in an SDN Controller (making routing/policy decisions), while the Data Plane remains on the switches/routers to forward packets at line rate.
B. The Data Plane is removed from switches so all user traffic passes through the SDN Controller's CPU.
C. Both Control Plane and Data Plane require manual CLI Telnet configuration on every box.
D. SDN eliminates APIs and uses only SNMPv1.

✔ Correct Answer: A. The Control Plane is centralized in an SDN Controller (making routing/policy decisions), while the Data Plane remains on the switches/routers to forward packets at line rate.

Technical Explanation: SDN decouples the intelligence (Control Plane) into a centralized controller (using Southbound APIs like NETCONF/OpenFlow and Northbound REST APIs), while physical switches handle high-speed packet forwarding (Data Plane).

Question 13 Compare Ansible, Puppet, Chef, and Terraform (CCNA 200-301 v1.1): Which tools are Agentless (Push model over SSH/NETCONF) versus Agent-based (Pull model)?

A. Agentless: Ansible and Terraform; Agent-based: Puppet and Chef
B. Agentless: Puppet and Chef; Agent-based: Ansible
C. All four require installing a Python agent on Cisco IOS switches.
D. None of them support JSON or YAML.

✔ Correct Answer: A. Agentless: Ansible and Terraform; Agent-based: Puppet and Chef

Technical Explanation: Ansible (YAML playbooks) and Terraform (HCL declarative files) are agentless and push configurations over SSH/NETCONF/RESTCONF without installing software on the network device. Puppet and Chef traditionally use device agents to pull configurations from a central master.

Question 14 According to the CCNA 200-301 v1.1 blueprint, how is Generative AI used differently from Predictive AI in modern network operations (AIOps)?

A. Predictive AI analyzes historical telemetry to forecast congestion and hardware faults before outages happen; Generative AI provides natural-language assistant interfaces to summarize incidents and generate CLI/JSON configs.
B. Generative AI replaces physical fiber optic cables; Predictive AI replaces Ethernet switches.
C. Predictive AI only works on IPv4; Generative AI only works on IPv6.
D. Both are routing protocols that replace BGP.

✔ Correct Answer: A. Predictive AI analyzes historical telemetry to forecast congestion and hardware faults before outages happen; Generative AI provides natural-language assistant interfaces to summarize incidents and generate CLI/JSON configs.

Technical Explanation: Domain 6 of CCNA 200-301 v1.1 tests the distinction between Predictive AI/Machine Learning (trend forecasting and anomaly detection in Cisco Catalyst Center) and Generative AI (LLM-powered troubleshooting assistants).

Question 15 Two Cisco switches are connected together, and both ports are configured in 'switchport mode dynamic auto'. Why does a trunk link fail to form?

A. Both ends are passive in dynamic auto mode, so neither initiates DTP trunk negotiation.
B. 802.1Q encapsulation is disabled.
C. PortFast blocks DTP frames.
D. VLAN 1 is shut down.

✔ Correct Answer: A. Both ends are passive in dynamic auto mode, so neither initiates DTP trunk negotiation.

Technical Explanation: Dynamic Auto waits passively for the other side to request a trunk. If both sides are Dynamic Auto, the link stays an access port. At least one side must be 'trunk' or 'dynamic desirable'.

Question 16 An administrator wants to add VLAN 50 to an existing 802.1Q trunk that already carries VLANs 10, 20, and 30. The administrator enters 'switchport trunk allowed vlan 50'. What happens?

A. VLAN 50 is appended to the list alongside 10, 20, and 30.
B. VLANs 10, 20, and 30 are removed from the trunk, and ONLY VLAN 50 is permitted, causing an outage.
C. The command is rejected by the switch.
D. The port enters err-disabled mode.

✔ Correct Answer: B. VLANs 10, 20, and 30 are removed from the trunk, and ONLY VLAN 50 is permitted, causing an outage.

Technical Explanation: Without the 'add' keyword ('switchport trunk allowed vlan add 50'), the command overwrites the entire allowed VLAN list with only VLAN 50.

Question 17 In a Router-on-a-Stick (ROAS) Inter-VLAN routing configuration, where is the 'encapsulation dot1Q [vlan-id]' command applied?

A. On the switch access ports.
B. On the router's logical subinterfaces (e.g., interface GigabitEthernet0/0/1.10) before assigning the IPv4 address.
C. In global configuration mode on the router.
D. Under the OSPF routing process.

✔ Correct Answer: B. On the router's logical subinterfaces (e.g., interface GigabitEthernet0/0/1.10) before assigning the IPv4 address.

Technical Explanation: In Router-on-a-Stick, each VLAN requires a router subinterface configured with 'encapsulation dot1Q [vlan-id]' prior to configuring its 'ip address'.

Question 18 When configuring Inter-VLAN routing on a Layer 3 Multilayer Switch using SVIs, which global command must be enabled so the switch routes packets between VLANs?

A. ip default-gateway
B. ip routing
C. switchport mode trunk
D. no switchport

✔ Correct Answer: B. ip routing

Technical Explanation: Even if multiple SVIs (interface Vlan10, interface Vlan20) are up/up with IP addresses, a Multilayer Switch will not route packets between them until 'ip routing' is entered in global configuration mode.

Question 19 How does Spanning Tree Protocol (STP) elect the Root Bridge in a Layer 2 switched topology?

A. The switch with the highest MAC address wins.
B. The switch with the lowest Bridge ID (consisting of Bridge Priority + Extended System ID + MAC Address) becomes the Root Bridge.
C. The switch with the fastest Gigabit uplink ports wins.
D. The switch with the highest uptime wins.

✔ Correct Answer: B. The switch with the lowest Bridge ID (consisting of Bridge Priority + Extended System ID + MAC Address) becomes the Root Bridge.

Technical Explanation: In STP, the lowest Bridge ID (BID) wins the Root Bridge election. By default, all switches have priority 32768 (+ VLAN ID), so the switch with the lowest MAC address wins unless an admin lowers the priority (e.g., 'spanning-tree vlan 10 priority 4096' or 'root primary').

Question 20 What are the three port states used by Rapid Spanning Tree Protocol (RSTP - IEEE 802.1w) compared to 802.1D?

A. Blocking, Listening, Learning
B. Discarding, Learning, Forwarding
C. Disabled, Standby, Active
D. Init, Exchange, Full

✔ Correct Answer: B. Discarding, Learning, Forwarding

Technical Explanation: RSTP (802.1w) combines the legacy 802.1D Disabled, Blocking, and Listening states into a single 'Discarding' state, leaving only Discarding, Learning, and Forwarding.

Question 21 Which command should be enabled on all access ports connected to end-user PCs so they transition immediately to the STP forwarding state, and what security feature should pair with it to shut down the port if a switch is plugged in?

A. PortFast and BPDU Guard
B. Root Guard and Loop Guard
C. UplinkFast and BackboneFast
D. DTP and VTP

✔ Correct Answer: A. PortFast and BPDU Guard

Technical Explanation: PortFast ('spanning-tree portfast') bypasses the 30-second listening/learning delay on host ports, while BPDU Guard ('spanning-tree bpduguard enable') immediately places the port into 'err-disabled' state if a rogue switch sends a BPDU.

Question 22 Which LACP (IEEE 802.3ad) mode combination will successfully form an EtherChannel between Switch A and Switch B?

A. Passive on Switch A and Passive on Switch B
B. Active on Switch A and Passive on Switch B (or Active/Active)
C. Desirable on Switch A and Auto on Switch B
D. On on Switch A and Active on Switch B

✔ Correct Answer: B. Active on Switch A and Passive on Switch B (or Active/Active)

Technical Explanation: LACP uses 'active' and 'passive' keywords (whereas Cisco PAgP uses 'desirable' and 'auto'). At least one side must be 'active' to initiate LACP negotiation.

Question 23 All physical interfaces bundled into an EtherChannel must match on which four parameters?

A. Speed, Duplex, Native/Allowed VLANs (if trunk), and Access VLAN (if access port)
B. Interface description, port number, MAC address, and cable length
C. IP address, hostname, VTP password, and SSH version
D. Port Security sticky MACs, QoS markings, and CDP timers

✔ Correct Answer: A. Speed, Duplex, Native/Allowed VLANs (if trunk), and Access VLAN (if access port)

Technical Explanation: If any member port in an EtherChannel has a different speed, duplex, switchport mode, or allowed VLAN list, the EtherChannel will fail to bundle or become suspended.

Question 24 When a DHCPv4 server is located on a different subnet/VLAN from the clients, which command must be configured on the router's LAN interface facing the clients to forward DHCP broadcasts as unicasts?

A. ip dhcp pool
B. ip helper-address [dhcp-server-ip]
C. ip dhcp snooping trust
D. service dhcp

✔ Correct Answer: B. ip helper-address [dhcp-server-ip]

Technical Explanation: Routers drop Layer 2 broadcasts (255.255.255.255) by default. Configuring 'ip helper-address' on the ingress router interface relays UDP broadcast services (including DHCP ports 67/68) as unicast packets to the central DHCP server.

Question 25 What is the difference between SLAAC, Stateless DHCPv6, and Stateful DHCPv6 when a router sends an ICMPv6 Router Advertisement (RA)?

A. SLAAC: M=0, O=0; Stateless DHCPv6: M=0, O=1 (IP from RA, DNS from DHCPv6); Stateful DHCPv6: M=1 (All config from DHCPv6 server).
B. SLAAC requires M=1; Stateful DHCPv6 requires M=0.
C. All three use the exact same M and O flag values.
D. Stateful DHCPv6 disables IPv6 link-local addresses.

✔ Correct Answer: A. SLAAC: M=0, O=0; Stateless DHCPv6: M=0, O=1 (IP from RA, DNS from DHCPv6); Stateful DHCPv6: M=1 (All config from DHCPv6 server).

Technical Explanation: The Managed (M) and Other (O) flags in the router's ICMPv6 RA message instruct the client whether to use SLAAC alone (M=0, O=0), SLAAC + Stateless DHCPv6 for DNS (M=0, O=1), or Stateful DHCPv6 for its IPv6 address (M=1).

Question 26 In HSRP (Hot Standby Router Protocol), what is the default priority value, and what virtual MAC address format does HSRP Version 1 use?

A. Priority 100; Virtual MAC 0000.0C07.ACxx (where xx is the HSRP group ID in hex)
B. Priority 255; Virtual MAC 0000.5E00.01xx
C. Priority 1; Virtual MAC FFFF.FFFF.FFFF
D. Priority 150; Virtual MAC 0000.0C9F.Fxxx

✔ Correct Answer: A. Priority 100; Virtual MAC 0000.0C07.ACxx (where xx is the HSRP group ID in hex)

Technical Explanation: HSRP defaults to priority 100. HSRPv1 uses the virtual MAC 0000.0C07.ACxx, while HSRPv2 uses 0000.0C9F.Fxxx (and VRRP uses 0000.5E00.01xx).

Question 27 Compare the three Cisco Switch Port Security violation modes: Protect, Restrict, and Shutdown. Which statement is true?

A. Protect drops frames silently; Restrict drops frames and logs a syslog/SNMP trap while incrementing the violation counter; Shutdown places the port into err-disabled state.
B. Protect shuts down the port immediately; Shutdown only logs a warning.
C. Restrict forwards unauthorized traffic but sends an email alert.
D. All three modes place the interface into err-disabled state.

✔ Correct Answer: A. Protect drops frames silently; Restrict drops frames and logs a syslog/SNMP trap while incrementing the violation counter; Shutdown places the port into err-disabled state.

Technical Explanation: Shutdown is the default violation mode and puts the interface into 'err-disabled' (requiring 'shutdown' then 'no shutdown' to recover). Restrict logs violations and increments counters without shutting the port, while Protect drops frames silently.

Question 28 How do DHCP Snooping and Dynamic ARP Inspection (DAI) work together to secure a Layer 2 switch?

A. DHCP Snooping builds a trusted Binding Database (MAC-to-IP-to-VLAN-to-Port) from legitimate DHCP ACK messages, and DAI uses that database to drop spoofed ARP packets on untrusted ports.
B. DAI encrypts all ARP packets using IPsec.
C. DHCP Snooping blocks all DHCP traffic on trunk ports.
D. Both features require disabling Spanning Tree Protocol.

✔ Correct Answer: A. DHCP Snooping builds a trusted Binding Database (MAC-to-IP-to-VLAN-to-Port) from legitimate DHCP ACK messages, and DAI uses that database to drop spoofed ARP packets on untrusted ports.

Technical Explanation: Dynamic ARP Inspection (DAI) depends directly on the DHCP Snooping Binding Database to validate incoming ARP replies on untrusted access ports and prevent ARP poisoning.

Question 29 When configuring a Floating Static Route as a backup path to an OSPF-learned route (Administrative Distance 110), what Administrative Distance (AD) value must be assigned to the static route?

A. 1 (Default static route AD)
B. Any value greater than 110 (e.g., 115 or 150)
C. 0
D. 90

✔ Correct Answer: B. Any value greater than 110 (e.g., 115 or 150)

Technical Explanation: A floating static route must have an Administrative Distance higher (less trustworthy) than the primary routing protocol (OSPF AD = 110) so it stays hidden until the OSPF route disappears.

Question 30 Which two characteristics describe UDP (User Datagram Protocol) compared to TCP? (Choose two.)

A. Connectionless transport with low overhead (8-byte header)
B. Guaranteed delivery using three-way handshakes and windowing
C. Best-effort delivery with no retransmission of lost datagrams
D. Flow control via sliding windows
E. Sequencing and acknowledgment of every packet

✔ Correct Answer: A. Connectionless transport with low overhead (8-byte header) & C. Best-effort delivery with no retransmission of lost datagrams

Technical Explanation: UDP is a lightweight, connectionless Layer 4 protocol with an 8-byte header that does not establish sessions or retransmit dropped packets, making it ideal for DNS, DHCP, VoIP, and TFTP.

Question 31 What are the three steps of the TCP Three-Way Handshake used to establish a reliable session?

A. SYN -> ACK -> FIN
B. SYN -> SYN-ACK -> ACK
C. REQUEST -> OFFER -> ACK
D. HELLO -> INIT -> FULL

✔ Correct Answer: B. SYN -> SYN-ACK -> ACK

Technical Explanation: The client sends a SYN segment, the server replies with a SYN-ACK segment, and the client completes the handshake with an ACK segment.

Question 32 Which well-known port numbers are used by HTTP, HTTPS, SSH, Telnet, and DNS respectively?

A. HTTP: 80, HTTPS: 443, SSH: 22, Telnet: 23, DNS: 53
B. HTTP: 21, HTTPS: 8080, SSH: 23, Telnet: 22, DNS: 67
C. HTTP: 80, HTTPS: 443, SSH: 25, Telnet: 110, DNS: 161
D. HTTP: 443, HTTPS: 80, SSH: 20, Telnet: 21, DNS: 53

✔ Correct Answer: A. HTTP: 80, HTTPS: 443, SSH: 22, Telnet: 23, DNS: 53

Technical Explanation: Memorizing well-known TCP/UDP ports is mandatory for CCNA: FTP (20/21), SSH (22), Telnet (23), SMTP (25), DNS (53 TCP/UDP), DHCP (67/68 UDP), TFTP (69 UDP), HTTP (80), POP3 (110), SNMP (161/162), HTTPS (443).

Question 33 What is the correct four-step order of messages exchanged when a client obtains an IPv4 address from a DHCPv4 server?

A. DHCPDISCOVER -> DHCPOFFER -> DHCPREQUEST -> DHCPACK (DORA)
B. DHCPREQUEST -> DHCPOFFER -> DHCPACK -> DHCPFIN
C. DHCPOFFER -> DHCPDISCOVER -> DHCPREQUEST -> DHCPACK
D. ARP Request -> DHCPOFFER -> DHCPACK -> Gratuitous ARP

✔ Correct Answer: A. DHCPDISCOVER -> DHCPOFFER -> DHCPREQUEST -> DHCPACK (DORA)

Technical Explanation: DHCPv4 follows the DORA process: Discover (broadcast by client), Offer (from server), Request (broadcast by client selecting the offer), and Acknowledgment (ACK from server).

Question 34 Which three commands are required on a Cisco router before you can generate RSA keys for SSH access? (Choose three.)

A. Configure a non-default hostname (e.g., hostname R1)
B. Configure a DNS domain name (e.g., ip domain-name cisco.com)
C. Generate the keys using 'crypto key generate rsa'
D. Enable Telnet on VTY lines
E. Configure OSPF routing

✔ Correct Answer: A. Configure a non-default hostname, B. Configure a DNS domain name, C. Generate the keys using 'crypto key generate rsa'

Technical Explanation: Cisco IOS combines the router's hostname and IP domain-name (e.g., R1.cisco.com) to label the RSA key pair generated by 'crypto key generate rsa'.

Question 35 Which Cisco IOS command blocks brute-force login attempts by shutting down login access for 120 seconds if 3 failed attempts occur within 60 seconds?

A. login block-for 120 attempts 3 within 60
B. security passwords min-length 10
C. exec-timeout 2 0
D. transport input ssh

✔ Correct Answer: A. login block-for 120 attempts 3 within 60

Technical Explanation: The 'login block-for [seconds] attempts [tries] within [seconds]' global configuration command mitigates dictionary/brute-force attacks against VTY and console lines.

Question 36 What is the purpose of the 'exec-timeout 5 30' command configured under 'line vty 0 4'?

A. It disconnects an idle SSH/Telnet session after 5 minutes and 30 seconds of inactivity.
B. It limits the total duration of any SSH connection to 5 hours and 30 minutes.
C. It requires a password between 5 and 30 characters long.
D. It delays login prompts by 5.3 seconds.

✔ Correct Answer: A. It disconnects an idle SSH/Telnet session after 5 minutes and 30 seconds of inactivity.

Technical Explanation: 'exec-timeout [minutes] [seconds]' automatically logs out inactive administrative sessions to prevent unattended terminals from being hijacked.

Question 37 Which command displays the neighboring Cisco devices directly connected to a router, including their Device ID, local interface, and hardware platform?

A. show ip route
B. show cdp neighbors
C. show arp
D. show interfaces

✔ Correct Answer: B. show cdp neighbors

Technical Explanation: Cisco Discovery Protocol (CDP) is a Layer 2 Cisco proprietary protocol enabled by default that discovers directly connected Cisco switches, routers, and IP phones.

Question 38 When troubleshooting network connectivity from a PC, an engineer can ping 127.0.0.1 and the PC's own IP (192.168.1.50), but cannot ping the Default Gateway (192.168.1.1). Where does the problem most likely reside?

A. The remote web server is offline.
B. The DNS server is misconfigured.
C. There is a Layer 1/Layer 2 issue on the local LAN (unplugged cable, wrong switch VLAN, or shut down router interface).
D. The PC's TCP/IP stack is corrupted.

✔ Correct Answer: C. There is a Layer 1/Layer 2 issue on the local LAN (unplugged cable, wrong switch VLAN, or shut down router interface).

Technical Explanation: Pinging 127.0.0.1 proves the PC's TCP/IP stack works. Failing to reach the local default gateway indicates a physical cabling fault, wrong VLAN assignment on the switch port, or a shut-down gateway interface.

ENSA Final Skills Exam: OSPFv2, Extended ACLs & PAT Overload CLI

Cisco IOS CLI - Verification & Lab Script

R1(config)# router ospf 1
R1(config-router)# router-id 1.1.1.1
R1(config-router)# network 10.0.0.0 0.0.0.255 area 0
R1(config-router)# default-information originate
R1(config)# ip nat inside source list 1 interface Gi0/0/1 overload

Cisco CCNA 200-301 v1.1 & NetAcad v7.02 / v8 Exam Portal

CCNA 3 v7.02 & v8 (ENSA) Complete Final Exam & Modules 1 - 14 Master Question Bank (2026)

Verified Cisco NetAcad Exam Questions (38 Core Questions + Explanations)

ENSA Final Skills Exam: OSPFv2, Extended ACLs & PAT Overload CLI

🔥 Related Cisco CCNA Practice Portals & Simlet Banks